Windows logs this event when an administrator changes the local policy of the Windows Firewall or a group policy refresh results in setting the Windows Firewall setting to allow or disable remote administration.